A software running exception identification system and method for a distributed environment

Abstract

This invention relates to the field of software runtime anomaly identification, and discloses a system and method for software runtime anomaly identification in distributed environments. The method includes parallel collection of thread switching rhythm, task queuing length, service call response, and resource occupancy status of computing nodes to construct a multi-level runtime behavior mapping sequence; forming a composite feature set through multi-scale coupling matrix analysis and temporal perturbation decomposition; performing multi-dimensional similarity matching between the composite feature set and a typical pattern library of historical stable operating intervals to calculate the implicit risk index and evolution trend score for each node and its combined states; constructing a complete vulnerable segment topology map by combining the node's real-time task queuing length, concurrent request count, and load prediction for multiple future scheduling cycles; and generating a multi-level intervention response scheme by combining the abrupt change points of the global load margin curve, multi-cycle evolution prediction, and node adaptive behavior feedback mechanism. This invention has the advantage of early detection of implicit anomalies.

Description

Technical Field

[0001] This invention relates to the field of software runtime anomaly identification, specifically to a software runtime anomaly identification system and method for distributed environments. Background Technology

[0002] In the actual operation of distributed software systems, they often operate under conditions of high load, high coupling, or strong operational constraints for extended periods. Even if the resource consumption, performance indicators, and operating status of each node are within normal threshold ranges in the short term, the internal operating status of the system will gradually deviate from the stable operating range during long-term evolution. When the business load structure changes, service call relationships are adjusted, or the system scales up or down, these deviations are easily triggered and amplified, causing the overall system operation to inevitably enter the early stage of anomaly. However, existing technologies mainly rely on node-level threshold judgment, single-indicator anomaly detection, or local statistical deviation analysis. They usually equate normal node status directly with overall system operational safety, lacking the ability to comprehensively analyze the combination of multiple node states and their evolutionary characteristics over time when all nodes are in normal condition. This makes it difficult to identify the hidden risks in the early stages of such anomalies in a timely manner, so that performance degradation, service failures, or cascading anomalies are often only discovered and intervened after they have become apparent. Summary of the Invention

[0003] To address the shortcomings of existing technologies, this invention provides a software operation anomaly identification system and method for distributed environments, which has the advantage of early detection of latent anomalies and solves the problems mentioned in the background technology.

[0004] To achieve the aforementioned goal of early detection of latent anomalies, this invention provides the following technical solution: a method for identifying software runtime anomalies in a distributed environment, comprising the following steps: Parallel data collection is performed on the thread switching rhythm, task queue length, service call response, and resource usage status of computing nodes. Combined with micro-time slice decomposition and inter-node dependency topology, a multi-level runtime behavior mapping sequence is constructed across nodes and time series. Based on the multi-level operational behavior mapping sequence, through multi-scale coupling matrix analysis and temporal perturbation decomposition, the cumulative effects of inter-node collaborative offset, call path fluctuation amplitude and task switching rhythm are extracted to form a composite feature set reflecting potential operational anomalies of the system. Multidimensional similarity matching is performed between the composite feature set and the typical pattern library of historical stable operating intervals. Combined with dependency propagation sensitivity analysis and service call chain impact diffusion, the implicit risk index and evolution trend score of each node and combined state are calculated. Based on the hidden risk index and evolution trend score, combined with the node's real-time task queuing length, concurrent request count, and load prediction for multiple future scheduling cycles, potential pressure propagation is mapped along the service call chain to construct a complete vulnerable segment topology map. Based on the abrupt change points of the complete vulnerable segment topology map and the global load margin curve, and combined with multi-period evolution prediction and node adaptive behavior feedback mechanism, a multi-level intervention response scheme is generated.

[0005] Preferably, the process of collecting data in parallel on the thread switching rhythm, task queue length, service call response, and resource usage status of computing nodes is as follows: By deploying multi-dimensional sensing points on each computing node, real-time data collection is performed on the state data of thread execution time slices, task queue length, service call latency, and CPU, memory, and network resource usage. During the data acquisition process, timestamp marking and serialization storage are used to perform micro-time slice splitting and parallel queue processing on the data. Through cross-node data buffering and synchronization mechanisms, the collected status data is transmitted and aggregated to form a unified multi-source operational status data stream.

[0006] Preferably, the process of constructing a multi-level runtime behavior mapping sequence across nodes and time series is as follows: The unified multi-source runtime status data stream is divided by nodes and time slices, and the thread switching segments, task queuing lengths and call response delays are vectorized and encoded. By combining the dependencies between nodes and the service call chain, the vectorized node behaviors are reorganized according to the topology to form a cross-node behavior mapping network. In the behavior mapping network, through multi-level combination and weighted fusion, the behavior of local nodes is associated with the call relationships, resource consumption and dependency propagation characteristics in the global service call chain, generating a multi-level running behavior mapping sequence that crosses nodes and time sequences.

[0007] Preferably, the process of forming a composite feature set reflecting potential operational anomalies of the system is as follows: The multi-level operational behavior mapping sequence is divided into the multi-scale coupling matrix according to the node level and time slice. In the coupling matrix, calculate the inter-node collaborative offset matrix, the task switching tick accumulation matrix, and the cross-node execution consistency matrix to quantify the node collaborative deviation and task switching rhythm changes. The time-perturbation signal and node state anomaly fluctuation in the multi-scale coupling matrix are decomposed, including trend components, periodic components and transient anomaly components, and the local anomaly accumulation effect is extracted. The cumulative effects of local anomalies are weighted and aggregated, and combined with the node criticality weight and the service call chain propagation influence coefficient, to form a composite feature set that reflects the potential operational anomalies of the system.

[0008] Preferably, the process of performing multi-dimensional similarity matching between the composite feature set and the typical pattern library of historical stable operating intervals is as follows: The composite feature set is expanded into a multi-dimensional vector according to node level, time slice and task dimension, and each dimension is standardized. Each pattern in the typical pattern library of historical stable intervals is subjected to the same vectorization and standardization process to form a comparable pattern matrix. Based on the multi-core similarity calculation method, the similarity scores of the composite feature set and the typical pattern in the dimensions of node collaborative offset, task switching beat and local anomaly cumulative effect are calculated respectively, and the scores of each dimension are weighted and fused to form a multi-dimensional similarity matrix. Based on a multidimensional similarity matrix, the degree of deviation between the current operating state and the typical pattern is quantified, and a subset of potential abnormal states is selected by dynamic threshold determination.

[0009] Preferably, the process of calculating the latent risk index and evolution trend score for each node and combination state is as follows: Map a subset of potential abnormal states to the corresponding service call chain and node topology to build a dependency propagation network between nodes; In a dependency propagation network between nodes, each node and its combined state are taken as the analysis object, and the propagation sensitivity based on the call chain weight is calculated. The calculated propagation sensitivity is used as a weight and combined with historical load data, task scheduling response time, and inter-node collaboration offset trend; We use weighted time series regression and exponential smoothing to calculate the implicit risk index and evolution trend score for each node and combination state.

[0010] Preferably, the process of combining the real-time task queue length of the node, the number of concurrent requests, and the load prediction for multiple future scheduling cycles is as follows: The implicit risk index and evolution trend score of each node and its combined state are mapped to the real-time running data of the corresponding node to form a node state augmentation dataset. Based on the node state augmentation dataset, combined with historical operation data and scheduling records, multi-step predictions are made on the load evolution of each node in multiple future scheduling cycles to generate a node load prediction sequence. A multidimensional coupling analysis was conducted between the node load prediction sequence and the latent risk index and evolution trend score to construct a set of node load risk weights.

[0011] Preferably, the process of constructing a complete topology map of vulnerable sections is as follows: Associating the node load risk weight set with the corresponding node's service call chain relationship, mapping potential pressure propagation paths, and forming a preliminary vulnerable segment topology; Based on the preliminary topology, local high-risk nodes and key call paths are identified. Combined with node load prediction sequences and implicit risk indices, the local topology of potential bottleneck sections is dynamically extracted. By integrating the local topology of the bottleneck section into the global service topology and combining node association relationships and path pressure propagation characteristics, a complete vulnerable section topology map containing node risk level, risk sensitivity, pressure propagation intensity, and time evolution information is generated.

[0012] Preferably, the process of generating a multi-level intervention response plan is as follows: Based on the complete vulnerable segment topology map, high-risk nodes and critical paths are identified, and potential pressure accumulation areas are determined by combining the abrupt change points of the global load margin curve. Based on the pressure accumulation area, the load change trend and pressure propagation path of each node are estimated by using the node load forecast of multiple future scheduling cycles. Based on load change trends and pressure propagation paths, combined with the real-time task queuing length, concurrent request count, and historical load behavior of nodes, the adaptive feedback strategy of nodes is dynamically adjusted to form a multi-level intervention response scheme.

[0013] A software runtime anomaly detection system for distributed environments includes: Behavior mapping module: performs parallel collection of computing node threads, tasks, calls and resource status, and constructs a multi-level runtime behavior mapping sequence across nodes and time series; Feature extraction module: Through multi-scale coupling analysis and temporal perturbation decomposition, it extracts node collaborative offset, call fluctuation and task switching cumulative effect to form a composite feature set; Risk assessment module: Matches composite features with a database of historical typical patterns, combines dependency propagation analysis, and calculates the implicit risk index and evolution trend score of nodes and combination states; Vulnerability Mapping Module: Based on risk index and load prediction, this module maps potential pressure propagation along the service call chain and constructs a complete vulnerability segment topology map. Intervention Decision Module: Combining the fragile topology map and the abrupt change points of the load curve, it generates multi-level intervention response schemes by utilizing multi-period prediction and node adaptive feedback.

[0014] Compared with existing technologies, the present invention provides a software runtime anomaly identification system and method for distributed environments, which has the following beneficial effects: This invention collects data in parallel on thread switching, task queuing, service response, and resource occupancy status of computing nodes in a distributed system. Combined with micro-time slice splitting and node dependency topology, it constructs a multi-level operational behavior mapping sequence across nodes and time series, achieving accurate characterization of the system state. Through multi-scale coupling matrix analysis and temporal perturbation decomposition, it extracts node collaboration deviations, call fluctuations, and cumulative effects of task switching, forming a composite feature set reflecting potential anomalies. By matching with historical stable patterns and dependency propagation sensitivity analysis, it calculates the implicit risk index and evolution trend score of computing nodes and their combined states, achieving quantitative judgment of potential failure risks. Furthermore, by combining real-time task queuing, concurrent requests, and load prediction, it maps potential pressure along the service call chain, constructs a complete vulnerable segment topology, and generates multi-level intervention response schemes, enabling anomaly prediction, location, and dynamic intervention. This significantly improves the accuracy and real-time performance of anomaly identification in distributed systems. It comprehensively considers node collaboration deviations, task switching, and call chain dependencies, achieving closed-loop management from data collection to risk assessment and intervention decision-making, overcoming the shortcomings of traditional methods in cross-node, cross-time series correlation analysis and potential risk quantification. Attached Figure Description

[0015] Figure 1 This is a schematic diagram of the method of the present invention; Figure 2 This is a schematic diagram of the system of the present invention. Detailed Implementation

[0016] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0017] Example 1: Please refer to Figure 1 As shown in the embodiment of the present invention, a method for identifying software runtime anomalies in a distributed environment includes the following steps: S1: Parallel collection of thread switching rhythm, task queuing length, service call response and resource usage status of computing nodes. Combined with micro time slice decomposition and inter-node dependency topology, a multi-level running behavior mapping sequence is constructed across nodes and across time series.

[0018] The process of parallel collection of thread switching rhythm, task queue length, service call response and resource usage status of computing nodes in S1 is as follows: By deploying multi-dimensional sensing points on each computing node, real-time data collection is performed on the state data of thread execution time slices, task queue length, service call latency, and CPU, memory, and network resource usage. In a distributed environment, several sensing points are deployed on each computing node to collect node running status information. Each sensing point is responsible for collecting the status data of threads within their execution time slice, including thread creation, ready, running, blocking, and wake-up events. It also collects resource consumption indicators such as task queue length, service call latency, CPU utilization, memory usage, and network throughput. Sensing points can be implemented through lightweight monitoring agents or built-in system hooks, converting data into structured formats such as JSON or vectorized arrays in real time and assigning a unified timestamp to ensure that data can be compared and synchronized across nodes and time slices.

[0019] During the data acquisition process, timestamp marking and serialization storage are used to perform micro-time slice splitting and parallel queue processing on the data. During the data acquisition process, the node running status is divided into micro-time slices, for example, each time slice is set to a length of 1 millisecond or 5 milliseconds, to ensure high-precision capture of thread switching rhythm and dynamic changes in the task queue. The data of each time slice is serialized and stored in a local cache queue for parallel processing and unified aggregation. The data queue can be implemented using a thread-safe queue or a circular buffer to achieve low-latency data writing in a high-concurrency environment. Each data record includes a timestamp, node identifier, thread ID, task ID, and resource usage indicators, and is arranged in time slice order for easy cross-node analysis.

[0020] Through cross-node data buffering and synchronization mechanisms, the collected status data is transmitted and aggregated to form a unified multi-source operational status data stream; To generate a unified multi-source operational status data stream, the collected data from each node needs to be aggregated through cross-node buffering and synchronization mechanisms. This includes deploying a local data buffer on each node, setting up a centralized data collection service, and sending node data to a centralized aggregation platform via an efficient network transmission protocol. The collection platform merges and sorts the data according to timestamps and marks it according to the node topology to achieve cross-node status alignment. To avoid data loss due to network latency or node failure, the aggregation process can employ retransmission mechanisms and data integrity verification to ensure that the generated multi-source operational status data stream is complete, accurate, and can be used in real time by the behavior mapping and feature extraction modules.

[0021] The process of constructing a multi-level runtime behavior mapping sequence across nodes and time series in S1 is as follows: The unified multi-source runtime status data stream is divided by nodes and time slices, and the thread switching segments, task queuing lengths and call response delays are vectorized and encoded. The previously collected unified multi-source runtime status data stream is divided into nodes and micro-time slices. Each time slice corresponds to a snapshot of the runtime status of a node. Indicators such as thread switching segments, task queue length, and service call response latency within each time slice are vectorized, mapping different types of status information to a unified numerical vector space. For example, the thread switching rhythm can be represented as the number of times each thread switches within a time slice, the task queue length can be represented by an integer vector to indicate the queue length change, and the service call latency can be normalized in milliseconds. The vectorized data is not only easy to compare across nodes, but can also be used for matrix analysis and aggregation calculations, ensuring that the behavioral data of each node can be accurately quantified.

[0022] By combining the dependencies between nodes and the service call chain, the vectorized node behaviors are reorganized according to the topology to form a cross-node behavior mapping network. By combining the vectorized node behavior data with the inter-node dependency relationships and service call chain information, and based on the node dependency topology discovered by system design or monitoring, the node behaviors are reorganized according to the call chain and dependency relationships. For example, for the case where service A depends on services B and C, the behavior vector of node A is associated with the behavior vectors of B and C in the order of calls, while retaining the time sequence information. This can construct a cross-node behavior mapping network, where each node behavior vector not only contains its own state, but also retains its upstream and downstream relationships and dependency characteristics in the service chain, thereby reflecting the collaborative operation status of the entire system.

[0023] In the behavior mapping network, through multi-level combination and weighted fusion, the behavior of local nodes is associated with the call relationship, resource consumption and dependency propagation characteristics in the global service call chain, generating a multi-level running behavior mapping sequence that crosses nodes and time sequences; Based on the behavior mapping network, multi-level combination and weighted fusion of node local behavior and global service call chain features are performed. Local behavior includes single node thread switching, queue length and resource consumption, while global features include node dependency propagation, call chain fluctuation and cross-node resource conflict. Weights are assigned to different features, such as thread switching rhythm with a weight of 0.3, task queue length with a weight of 0.4 and call chain fluctuation with a weight of 0.3. A comprehensive vector representation is formed by weighted summation or matrix fusion. Finally, the weighted combination of each node is arranged in time series to generate a multi-level running behavior mapping sequence that crosses nodes and time series, providing complete and structured input data for feature extraction, anomaly identification and risk analysis.

[0024] S2: Based on the multi-level operational behavior mapping sequence, through multi-scale coupling matrix analysis and temporal disturbance decomposition, the cumulative effects of inter-node collaborative offset, call path fluctuation amplitude and task switching rhythm are extracted to form a composite feature set reflecting potential operational anomalies of the system.

[0025] The process of forming a composite feature set reflecting potential operational anomalies in S2 is as follows: The multi-level operational behavior mapping sequence is divided into the multi-scale coupling matrix according to the node level and time slice. The multi-level operation behavior mapping sequence across nodes and time series is divided according to node level and time slice and input into a multi-scale coupling matrix. The coupling matrix can be designed as a two-dimensional or three-dimensional matrix structure, where rows represent nodes, columns represent time slices, and matrix elements represent the behavior feature vectors of nodes in that time slice. For multi-level features, matrix stacking or block matrix methods can be used to ensure that local node behavior, global service chain relationship and cross-node dependency information can be reflected in the matrix at the same time, so as to realize multi-dimensional coupling representation.

[0026] In the coupling matrix, calculate the inter-node collaborative offset matrix, the task switching tick accumulation matrix, and the cross-node execution consistency matrix to quantify the node collaborative deviation and task switching rhythm changes. Within the multi-scale coupling matrix, the inter-node collaborative offset matrix, the task switching rhythm accumulation matrix, and the cross-node execution consistency matrix are calculated respectively. The inter-node collaborative offset matrix measures the degree of deviation between the behavior vector of each node and the time series of its dependent nodes. For example, Euclidean distance or cosine similarity is used to calculate the collaborative difference between nodes. The task switching rhythm accumulation matrix records the task switching frequency and rhythm changes of each node in each time slice. The changes are accumulated to form a matrix, reflecting the node load fluctuation trend. The cross-node execution consistency matrix quantifies the consistency between the task execution order of nodes and the expected order of the service call chain. For example, it is calculated by topology sorting deviation or sequence matching score. Through these matrices, the node collaboration deviation, task switching rhythm changes, and cross-node execution deviation can be accurately quantified, providing basic data for the extraction of abnormal features.

[0027] The time-perturbation signal and node state anomaly fluctuation in the multi-scale coupling matrix are decomposed, including trend components, periodic components and transient anomaly components, and the local anomaly accumulation effect is extracted. Signal decomposition is performed on time-perturbation signals and abnormal fluctuations in node states within a multi-scale coupling matrix. This decomposition includes trend components, periodic components, and transient anomaly components. Trend components reflect long-term load or behavioral deviations and can be obtained through moving averages or low-pass filtering. Periodic components capture the system's periodic tasks or call patterns and can be extracted using Fourier transforms or wavelet analysis. Transient anomaly components identify sudden events or abnormal fluctuations and can be obtained through high-frequency components or anomaly detection algorithms. Through decomposition, the cumulative effects of different types of anomalies can be independently quantified, providing controllable basic data for composite feature aggregation.

[0028] The cumulative effects of local anomalies are weighted and aggregated, and combined with the node criticality weight and the service call chain propagation influence coefficient, to form a composite feature set that reflects the potential operational anomalies of the system. The cumulative effects of local anomalies are weighted and aggregated, and a composite feature set is generated by combining the node criticality weight and the service call chain propagation influence coefficient. The node criticality weight can be set according to the node's centrality in the system topology, the number of calls, or the proportion of critical tasks. The service call chain propagation influence coefficient can be quantified according to the potential impact of the node on the load of downstream nodes. The weighted aggregation method can adopt linear weighted summation or matrix fusion strategy to combine trend, periodic and transient anomaly components into a composite feature vector of each node, and finally form a composite feature set of potential operational anomalies of the overall system, providing high-precision input data for risk assessment and anomaly identification modules.

[0029] S3: Perform multi-dimensional similarity matching between the composite feature set and the typical pattern library of historical stable operating intervals. Combine dependency propagation sensitivity analysis and service call chain impact diffusion to calculate the implicit risk index and evolution trend score of each node and combined state.

[0030] The process of performing multi-dimensional similarity matching between the composite feature set and the typical pattern library of historical stable operating intervals in S3 is as follows: The composite feature set is expanded into a multi-dimensional vector according to node level, time slice and task dimension, and each dimension is standardized. The composite feature set is expanded into a multi-dimensional vector according to the node level, time slice, and task dimension. The task and state features of each node in each time slice are encoded as vector elements, including indicators such as node collaborative offset, task switching beat, and anomaly accumulation effect. In order to eliminate the influence of different units on similarity calculation, the feature vectors of each dimension are standardized. For example, the Z-score standardization method is used to normalize the mean to zero and the standard deviation to one, so as to ensure that each feature is comparable in subsequent calculations.

[0031] Each pattern in the typical pattern library of historical stable intervals is subjected to the same vectorization and standardization process to form a comparable pattern matrix. Each pattern in the typical pattern library of historical stable operating intervals undergoes the same vectorization and standardization processing. Typical patterns can be derived from anomaly-free intervals in long-term operation monitoring data, including state information such as thread switching rhythm, task queue length, and resource consumption of each node. Each pattern is encoded into a vector according to node level, time slice, and task dimension, and then standardized to ensure that it has the same data structure and dimensions as the vector of the composite feature set, forming a comparable pattern matrix. This ensures that the composite features and historical patterns can be directly compared and similarity evaluated dimension by dimension during calculation.

[0032] Based on the multi-core similarity calculation method, the similarity scores of the composite feature set and the typical pattern in the dimensions of node collaborative offset, task switching beat and local anomaly cumulative effect are calculated respectively, and the scores of each dimension are weighted and fused to form a multi-dimensional similarity matrix. A multi-kernel similarity calculation method is adopted to quantify the similarity between the composite feature set and the typical pattern in various dimensions. The similarity scores of three main dimensions, namely node collaborative offset, task switching beat, and local anomaly cumulative effect, are calculated. These scores can be obtained by using cosine similarity, Euclidean distance, or kernel function similarity calculation methods, respectively. The similarity scores of each dimension are then weighted and fused according to preset weights. For example, the weight of node collaborative offset is 0.4, the weight of task switching beat is 0.35, and the weight of local anomaly cumulative effect is 0.25, forming a multi-dimensional similarity matrix that can comprehensively reflect the degree of deviation between the current operating state and the historical stable pattern, taking into account the importance of different feature dimensions.

[0033] Based on a multidimensional similarity matrix, the degree of deviation between the current operating state and the typical pattern is quantified, and a subset of potential abnormal states is selected by dynamic threshold determination. Based on the multidimensional similarity matrix, the deviation between the current operating state and the typical pattern is quantitatively evaluated. Dynamic thresholds are set, such as by calculating the mean and standard deviation of historical operating data. Nodes, time slices, or task combinations with deviations exceeding the threshold are identified as potential abnormal states. A subset of potential abnormal states is formed through screening, which includes nodes and related task information that may have collaboration deviations, abnormal task switching, or resource bottlenecks. This provides accurate data support for the calculation of implicit risk index and topology analysis of vulnerable sections. The screening process can use parallel computing methods to ensure that the subset of abnormal states is generated quickly in a distributed environment.

[0034] The process of calculating the latent risk index and evolution trend score for each node and combination state in S3 is as follows: Map a subset of potential abnormal states to the corresponding service call chain and node topology to build a dependency propagation network between nodes; A subset of potential abnormal states is mapped to the corresponding service call chain and node topology. Based on system design or operation monitoring data, a dependency propagation network between nodes is established, where each node represents a computing node, and the edges represent the call dependency relationship or data transmission path between nodes. Each edge can be attached with weight information such as call frequency, latency, and resource consumption to reflect the potential pressure propagation capability and criticality between nodes. This can clearly identify which node anomalies may affect other nodes through the call chain.

[0035] In a dependency propagation network between nodes, each node and its combined state are taken as the analysis object, and the propagation sensitivity based on the call chain weight is calculated. By taking the inter-node dependency propagation network as the analysis object, the propagation sensitivity of each node and the combined state is calculated. The propagation sensitivity can be measured by quantifying the potential impact of node anomalies on the load or response time of downstream nodes. For example, the sensitivity of each node to the entire network can be calculated by using weighted path length or node centrality index. For node combinations, the cooperative offset, task switching time, and resource consumption synchronization of nodes within the combination can be considered to comprehensively calculate the sensitivity of the combined state, so as to reflect the possibility of system fluctuations caused by abnormal collaboration of multiple nodes.

[0036] The calculated propagation sensitivity is used as a weight and combined with historical load data, task scheduling response time, and inter-node collaboration offset trend; Propagation sensitivity is used as a weight, combined with historical load data, task scheduling response time, and inter-node collaboration offset trend. Historical load data includes the utilization of resources such as CPU, memory, and network. Task scheduling response time reflects the node's processing capacity, while collaboration offset trend reflects the coordination of task scheduling and execution among nodes. After these data are uniformly normalized, they are weighted and integrated with propagation sensitivity as the weight to form a comprehensive index, which is used to describe the potential risk tolerance and abnormal propagation probability of a node or node combination state.

[0037] We use weighted time series regression and exponential smoothing to calculate the implicit risk index and evolution trend score for each node and combination state. We employ weighted time series regression and exponential smoothing to calculate the risk index and evolution trend score for each node and node combination state. Time series regression is used to fit the relationship between the historical behavior characteristics of nodes and potential anomalies, while exponential smoothing is used to predict short-term load fluctuations and anomaly trends. By comprehensively modeling the propagation sensitivity, historical load, and cooperative offset trends, we calculate the implicit risk index and evolution trend score for each node and combination state in the future scheduling cycles, providing quantifiable risk assessment results for topology construction and intervention decisions in vulnerable sections.

[0038] S4: Based on the implicit risk index and evolution trend score, combined with the node's real-time task queuing length, concurrent request count, and load prediction for multiple future scheduling cycles, map the potential pressure propagation along the service call chain to construct a complete vulnerable segment topology map.

[0039] In S4, the process of load prediction combining real-time task queue length, concurrent request count, and load over multiple future scheduling cycles is as follows: The implicit risk index and evolution trend score of each node and its combined state are mapped to the real-time running data of the corresponding node to form a node state augmentation dataset. The implicit risk index and evolution trend score of each node and node combination state are mapped to the real-time operation data of the corresponding node, including thread switching rhythm, task queue length, service call response time and resource consumption. This information is integrated to form a node state enhancement dataset, and each record contains the node's real-time state characteristics, implicit risk indicators and trend scores.

[0040] Based on the node state augmentation dataset, combined with historical operation data and scheduling records, multi-step predictions are made on the load evolution of each node in multiple future scheduling cycles to generate a node load prediction sequence. Based on the node state augmentation dataset, combined with historical operation data and scheduling records, multi-step predictions are made on the load evolution of each node in multiple future scheduling cycles. The prediction method can adopt time series prediction models, such as LSTM, ARIMA or weighted regression models. Combined with historical load fluctuations, task execution rhythm and scheduling strategies, a node load prediction sequence is generated, which can accurately reflect the potential load fluctuations of nodes in continuous scheduling cycles.

[0041] A multidimensional coupling analysis was conducted between the node load prediction sequence and the latent risk index and evolution trend score to construct a set of node load risk weights. The generated node load prediction sequence is coupled with the implicit risk index and evolution trend score of each node and combination state in a multidimensional analysis. By weighting the load prediction value with the risk index or merging it into a matrix, a load risk weight set for each node and node combination can be formed. The weight set can quantify the risk level of the node that may cause system pressure propagation in the future scheduling cycle, providing basic data for vulnerable section topology construction and intervention decision-making.

[0042] The process of constructing a complete topology map of vulnerable sections in S4 is as follows: Associating the node load risk weight set with the corresponding node's service call chain relationship, mapping potential pressure propagation paths, and forming a preliminary vulnerable segment topology; By associating the node load risk weight set with the service call chain relationship of the corresponding node, and using the call dependencies and task scheduling paths between nodes, possible pressure propagation paths are mapped out to form a preliminary vulnerable segment topology. Each node is marked with its load risk level in the topology, and the edges represent the potential pressure propagation direction and intensity. This can initially identify possible high-risk links and node combinations in the system, providing a basic data structure for local bottleneck analysis.

[0043] Based on the preliminary topology, local high-risk nodes and key call paths are identified. Combined with node load prediction sequences and implicit risk indices, the local topology of potential bottleneck sections is dynamically extracted. Based on the initial topology, local high-risk nodes and key call paths are identified. By combining node load prediction sequences and implicit risk indices, potential bottleneck sections are dynamically extracted. A weighted screening method is used to include nodes with high load, high propagation sensitivity, and significant collaboration deviations, along with their call paths, into the local topology region. By analyzing the evolution trend of node states through a rolling time window, possible risk diffusion paths of the local topology in future scheduling cycles are extracted, providing a reference for global topology optimization.

[0044] The local topology of the bottleneck section is integrated into the global service topology, and combined with the node association relationship and path pressure propagation characteristics, a complete vulnerable section topology map containing node risk level, risk sensitivity, pressure propagation intensity and time evolution information is generated. The topology of local bottleneck sections is integrated into the global service topology. During the integration process, the dependencies between nodes, call paths, and pressure propagation characteristics are considered. The risk level, risk sensitivity, pressure propagation intensity, and time evolution information of each node are marked on the topology map. Finally, a complete vulnerable section topology map is generated, which can intuitively display the potential risk distribution and pressure propagation dynamics of each node and path in the system. This provides data support for the formulation of intervention strategies and enables the visualized location and precise management of potential anomalies in the distributed system.

[0045] S5: Based on the abrupt change points of the complete vulnerable segment topology map and the global load margin curve, combined with multi-cycle evolution prediction and node adaptive behavior feedback mechanism, a multi-level intervention response scheme is generated.

[0046] The process of generating a multi-level intervention response plan in S5 is as follows: Based on the complete vulnerable segment topology map, high-risk nodes and critical paths are identified, and potential pressure accumulation areas are determined by combining the abrupt change points of the global load margin curve. Based on the complete vulnerable segment topology map, high-risk nodes and critical call paths in the system are identified. Combined with the abrupt change points of the global load margin curve, areas where pressure may be concentrated or accumulated are marked. By using threshold screening based on node load risk weight, implicit risk index and pressure propagation intensity, the combination of nodes that are prone to exceeding the load limit or are sensitive to propagation can be located, thereby clarifying the system areas that need priority intervention and providing a precise target range for intervention strategies.

[0047] Based on the pressure accumulation area, the load change trend and pressure propagation path of each node are estimated by using the node load forecast of multiple future scheduling cycles. For areas of pressure accumulation, the load change trend of each node is estimated by using the node load prediction sequence of multiple scheduling cycles in the future. The call dependency relationship between nodes and the pressure propagation path are combined into the predictive analysis to simulate the spread of abnormal load in the service chain. This can predict the direction, intensity and time evolution of pressure propagation in advance, provide dynamic reference for intervention strategies, and ensure that intervention measures can effectively mitigate potential risks.

[0048] Based on load change trends and pressure propagation paths, combined with the real-time task queuing length, concurrent request count, and historical load behavior of nodes, the adaptive feedback strategy of nodes is dynamically adjusted to form a multi-level intervention response scheme. Based on load change trends and pressure propagation paths, combined with the real-time task queuing length, concurrent request count, and historical load behavior of nodes, the adaptive feedback strategy of nodes is dynamically adjusted. Intervention measures may include priority adjustment, dynamic resource allocation, task scheduling optimization, or local load throttling. By implementing these measures in a multi-level strategy, high-risk nodes and critical paths are controlled in real time, thus forming a multi-level intervention response plan. This can reduce pressure accumulation and anomaly risks while ensuring the normal operation of the system, and achieve real-time management and dynamic optimization of potential anomalies in the distributed system.

[0049] Example 2: Please refer to Figure 2 As shown, a software runtime anomaly identification system for distributed environments includes: Behavior mapping module: performs parallel collection of computing node threads, tasks, calls and resource status, and constructs a multi-level runtime behavior mapping sequence across nodes and time series; Feature extraction module: Through multi-scale coupling analysis and temporal perturbation decomposition, it extracts node collaborative offset, call fluctuation and task switching cumulative effect to form a composite feature set; Risk assessment module: Matches composite features with a database of historical typical patterns, combines dependency propagation analysis, and calculates the implicit risk index and evolution trend score of nodes and combination states; Vulnerability Mapping Module: Based on risk index and load prediction, this module maps potential pressure propagation along the service call chain and constructs a complete vulnerability segment topology map. Intervention Decision Module: Combining the fragile topology map and the abrupt change points of the load curve, it generates multi-level intervention response schemes by utilizing multi-period prediction and node adaptive feedback.

[0050] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus.

[0051] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A method for identifying software runtime anomalies in a distributed environment, characterized in that, Includes the following steps: Parallel data collection is performed on the thread switching rhythm, task queue length, service call response, and resource usage status of computing nodes. Combined with micro-time slice decomposition and inter-node dependency topology, a multi-level runtime behavior mapping sequence is constructed across nodes and time series. Based on the multi-level operational behavior mapping sequence, through multi-scale coupling matrix analysis and temporal perturbation decomposition, the cumulative effects of inter-node collaborative offset, call path fluctuation amplitude and task switching rhythm are extracted to form a composite feature set reflecting potential operational anomalies of the system. Multidimensional similarity matching is performed between the composite feature set and the typical pattern library of historical stable operating intervals. Combined with dependency propagation sensitivity analysis and service call chain impact diffusion, the implicit risk index and evolution trend score of each node and combined state are calculated. Based on the hidden risk index and evolution trend score, combined with the node's real-time task queuing length, concurrent request count, and load prediction for multiple future scheduling cycles, potential pressure propagation is mapped along the service call chain to construct a complete vulnerable segment topology map. Based on the abrupt change points of the complete vulnerable segment topology map and the global load margin curve, and combined with multi-period evolution prediction and node adaptive behavior feedback mechanism, a multi-level intervention response scheme is generated.

2. The method for identifying software runtime anomalies in a distributed environment according to claim 1, characterized in that, The process of collecting data in parallel on the thread switching rhythm, task queue length, service call response, and resource usage status of computing nodes is as follows: By deploying multi-dimensional sensing points on each computing node, real-time data collection is performed on the state data of thread execution time slices, task queue length, service call latency, and CPU, memory, and network resource usage. During the data acquisition process, timestamp marking and serialization storage are used to perform micro-time slice splitting and parallel queue processing on the data. Through cross-node data buffering and synchronization mechanisms, the collected status data is transmitted and aggregated to form a unified multi-source operational status data stream.

3. The method for identifying software runtime anomalies in a distributed environment according to claim 2, characterized in that, The process of constructing a multi-level runtime behavior mapping sequence across nodes and time series is as follows: The unified multi-source runtime status data stream is divided by nodes and time slices, and the thread switching segments, task queuing lengths and call response delays are vectorized and encoded. By combining the dependencies between nodes and the service call chain, the vectorized node behaviors are reorganized according to the topology to form a cross-node behavior mapping network. In the behavior mapping network, through multi-level combination and weighted fusion, the behavior of local nodes is associated with the call relationships, resource consumption and dependency propagation characteristics in the global service call chain, generating a multi-level running behavior mapping sequence that crosses nodes and time sequences.

4. The method for identifying software runtime anomalies in a distributed environment according to claim 3, characterized in that, The process of forming a composite feature set reflecting potential operational anomalies in the system is as follows: The multi-level operational behavior mapping sequence is divided into the multi-scale coupling matrix according to the node level and time slice. In the coupling matrix, calculate the inter-node collaborative offset matrix, the task switching tick accumulation matrix, and the cross-node execution consistency matrix to quantify the node collaborative deviation and task switching rhythm changes. The time-perturbation signal and node state anomaly fluctuation in the multi-scale coupling matrix are decomposed, including trend components, periodic components and transient anomaly components, and the local anomaly accumulation effect is extracted. The cumulative effects of local anomalies are weighted and aggregated, and combined with the node criticality weight and the service call chain propagation influence coefficient, to form a composite feature set that reflects the potential operational anomalies of the system.

5. The method for identifying software runtime anomalies in a distributed environment according to claim 4, characterized in that, The process of performing multi-dimensional similarity matching between the composite feature set and a typical pattern library of historical stable operating intervals is as follows: The composite feature set is expanded into a multi-dimensional vector according to node level, time slice and task dimension, and each dimension is standardized. Each pattern in the typical pattern library of historical stable intervals is subjected to the same vectorization and standardization process to form a comparable pattern matrix. Based on the multi-core similarity calculation method, the similarity scores of the composite feature set and the typical pattern in the dimensions of node collaborative offset, task switching beat and local anomaly cumulative effect are calculated respectively, and the scores of each dimension are weighted and fused to form a multi-dimensional similarity matrix. Based on a multidimensional similarity matrix, the degree of deviation between the current operating state and the typical pattern is quantified, and a subset of potential abnormal states is selected by dynamic threshold determination.

6. The method for identifying software runtime anomalies in a distributed environment according to claim 5, characterized in that, The process of calculating the latent risk index and evolution trend score for each node and combination state is as follows: Map a subset of potential abnormal states to the corresponding service call chain and node topology to build a dependency propagation network between nodes; In a dependency propagation network between nodes, each node and its combined state are taken as the analysis object, and the propagation sensitivity based on the call chain weight is calculated. The calculated propagation sensitivity is used as a weight and combined with historical load data, task scheduling response time, and inter-node collaboration offset trend; We use weighted time series regression and exponential smoothing to calculate the implicit risk index and evolution trend score for each node and combination state.

7. The method for identifying software runtime anomalies in a distributed environment according to claim 6, characterized in that, The process of combining real-time task queue length, concurrent request count, and load prediction for multiple future scheduling cycles is as follows: The implicit risk index and evolution trend score of each node and its combined state are mapped to the real-time running data of the corresponding node to form a node state augmentation dataset. Based on the node state augmentation dataset, combined with historical operation data and scheduling records, multi-step predictions are made on the load evolution of each node in multiple future scheduling cycles to generate a node load prediction sequence. A multidimensional coupling analysis was conducted between the node load prediction sequence and the latent risk index and evolution trend score to construct a set of node load risk weights.

8. The method for identifying software runtime anomalies in a distributed environment according to claim 7, characterized in that, The process of constructing a complete topology map of vulnerable sections is as follows: Associating the node load risk weight set with the corresponding node's service call chain relationship, mapping potential pressure propagation paths, and forming a preliminary vulnerable segment topology; Based on the preliminary topology, local high-risk nodes and key call paths are identified. Combined with node load prediction sequences and implicit risk indices, the local topology of potential bottleneck sections is dynamically extracted. By integrating the local topology of the bottleneck section into the global service topology and combining node association relationships and path pressure propagation characteristics, a complete vulnerable section topology map containing node risk level, risk sensitivity, pressure propagation intensity, and time evolution information is generated.

9. A method for identifying software runtime anomalies in a distributed environment according to claim 8, characterized in that, The process of generating a multi-level intervention response plan is as follows: Based on the complete vulnerable segment topology map, high-risk nodes and critical paths are identified, and potential pressure accumulation areas are determined by combining the abrupt change points of the global load margin curve. Based on the pressure accumulation area, the load change trend and pressure propagation path of each node are estimated by using the node load forecast of multiple future scheduling cycles. Based on load change trends and pressure propagation paths, combined with the real-time task queuing length, concurrent request count, and historical load behavior of nodes, the adaptive feedback strategy of nodes is dynamically adjusted to form a multi-level intervention response scheme.

10. A software runtime anomaly identification system for distributed environments, applied to the method described in any one of claims 1-9, characterized in that, include: Behavior mapping module: performs parallel collection of computing node threads, tasks, calls and resource status, and constructs a multi-level runtime behavior mapping sequence across nodes and time series; Feature extraction module: Through multi-scale coupling analysis and temporal perturbation decomposition, it extracts node collaborative offset, call fluctuation and task switching cumulative effect to form a composite feature set; Risk assessment module: Matches composite features with a database of historical typical patterns, combines dependency propagation analysis, and calculates the implicit risk index and evolution trend score of nodes and combination states; Vulnerability Mapping Module: Based on risk index and load prediction, this module maps potential pressure propagation along the service call chain and constructs a complete vulnerability segment topology map. Intervention Decision Module: Combining the fragile topology map and the abrupt change points of the load curve, it generates multi-level intervention response schemes by utilizing multi-period prediction and node adaptive feedback.

Images